We are looking for an enthusiastic and detail-oriented Vulnerability Management Analyst to join our information security and data protection team. This is an ideal opportunity for someone with real-world experience in information security and data protection. It's a great opportunity to get hands-on with the tools and processes that keep all our products secure, and to make a genuinely visible difference to how we manage risk day to day.The Role: The Vulnerability Management Analyst will help us find, prioritise, and fix security vulnerabilities across our global business and all our products. You’ll configure and tune our vulnerability tools, risk assessing detections, and prioritising findings for fix. You’ll cover code vulnerabilities (SAST, DAST, SCA, OSS licencing), Cloud Security Posture Management (CSPM), Internal Vulnerability Scanning (IVS), and penetration testing. You'll also help design and report on our detection and remediation activities. This is a full-time position. Occasional after-hours work may be required for incident response or urgent security tasks. Successful candidates will be enrolled on a fully funded training pathway and will be provided with mentoring support to help them grow and learn.Responsibilities: 1. Configuring and tuning our toolsHelp configure, tune, and maintain our vulnerability tooling across scanning tools, working with platform and engineering teams to keep coverage accurateSupport day-to-day scanning schedules and tooling integrations, including ticketing and CI/CD pipelinesLook for opportunities to automate reporting, validation, and other repetitive tasks across the whole vulnerability lifecycle2. Triage and risk assessmentTriage findings from vulnerability sources, confirming genuine issues and filtering out false positivesRisk-assess confirmed findings against severity, exploitability, and business context, to prioritise fixesApply a consistent risk-scoring approach so findings are prioritised effectively, regardless of sourceStay on top of current threats and trends (e.g. threat actors, new vulnerabilities etc.) to inform vulnerability management activities3. Designing secure benchmarks and guidelinesDevelop and maintain secure configuration benchmarks and hardening guidelines for our software, infrastructure, and toolingAlign benchmarks and guidelines to recognised industry frameworks for businessWork with the right teams to help implement the secure configurations, providing practical advice, and facilitating deviations within our broader risk management framework4. Working with Developers and EngineersAct as a primary contact point for Developers and Engineers to help them understand and fix issuesTrack remediation progress, chase owners on overdue items, escalate where necessarySupport teams with practical remediation guidance, drawing on the OWASP Top 10, the Mitre Att&ck Framework, and our secure coding standards5. Coordinating IVS, web application testing, and penetration testingOrganise our externally delivered IVS and Penetration Testing programmes, from scheduling and scoping, through to day-to-day contact with our testing partnersHelp manage our relationships with testing providers, including engagement administration and reporting6. SLAs, outcome driven metrics, and reportingHelp design and report on remediation SLAs across vulnerability classes, severities, and productsProduce regular reporting (monthly, quarterly, and ad-hoc) on SLA performance, open findings, and trendsFeed data and insight into our wider security metrics and reporting processes7. Continuous improvement and team supportSuggest ways to improve how we manage vulnerabilities and the tools we use to do itSupport the rollout of new scanning tools or process changes across our global product estateHelp create and maintain our vulnerability management policies, standards, and proceduresRequirements:2+ years' experience in vulnerability management, security operations, development, or a related security/IT roleHands-on experience with vulnerability scanning and management tooling (e.g. SAST, DAST, SCA, CSPM, or IVS) Solid understanding of common vulnerability types and remediation approaches, including familiarity with the Mitre ATT&CK Framework and OWASP Top 10Experience triaging and risk-assessing security findings, helping teams to prioritise remediation based on severity and business impactComfortable coordinating third-party engagements, such as scheduling and scoping penetration testsComfortable explaining technical findings to both Developers and non-technical stakeholdersOrganised enough to manage several scanning programmes, testing engagements, and remediation workstreams in parallelComfortable working across a global, multi-product environmentComfortable working within an agile enterprise environmentAbility to read and understand common coding languages is essential, the ability to write scripts and/or code is preferredRelevant certifications (e.g. CompTIA Security+, CompTIA CySA+, GIAC GFACT/GPEN, or CEH) are preferred but not essentialStrong analytical and problem-solving mindset, with real attention to detailAbility to work autonomously, use good judgement, and know when to escalateBenefitsPerks at ITG — alongside a competitive salary, here's what you can look forward to:Time off that works for you — 25 days' holiday + bank holidays, a paid Wellbeing Day, flexible bank holidays to honour cultural or religious observances, and the option to buy or carry over up to 5 extra days.Family & life milestones — Enhanced family friendly leave, 3 extra days for your wedding/honeymoon, and an Employee Assistance Programme whenever you need support.Financial perks — Pension scheme, Corporate Medical Cash Plan, electric car salary sacrifice scheme, and tax-efficient payroll giving to your favourite charities.Growth & recognition — Funding for professional qualifications, monthly Employee of the Month awards (£250 bonus), and referral bonuses of up to £1,500.Community & wellbeing — Regular Wellbeing Workshops, 30+ Wellbeing Champions, a paid Volunteer Day, and an online perks platform with discounts on top brands, days out, and gym memberships.What next? Like what you see? Drop us your application and someone from our team will be in touch.We Value DiversityWe champion and welcome diversity in our workforce and ensure all job applicants receive equal and fair treatment, regardless of age, race, gender or gender identity, religion, sexual orientation, disability, or nationality.We are not only committed to increasing the visibility and recognition of talent from under-represented groups within our organisation, but the wider industry too.At the end of the day, we make sure we take time to look after ourselves, each other, and the planet, because we’re always stronger together.ITG have a number of community groups available to employees and exist to offer a safe space for like-minded colleagues, with shared interests to connect, socialise and check in with each other.What next?If you found yourself interested in knowing more, drop us your application and someone from our team will be in touch.#LI-NW1
We are looking for an enthusiastic and detail-oriented Vulnerability Management Analyst to join our information security and data protection team. This is an ideal opportunity for someone with real-world experience in information security and data protection. It's a great opportunity to get hands-on with the tools and processes that keep all our products secure, and to make a genuinely visible difference to how we manage risk day to day.
The Role:
The Vulnerability Management Analyst will help us find, prioritise, and fix security vulnerabilities across our global business and all our products. You’ll configure and tune our vulnerability tools, risk assessing detections, and prioritising findings for fix. You’ll cover code vulnerabilities (SAST, DAST, SCA, OSS licencing), Cloud Security Posture Management (CSPM), Internal Vulnerability Scanning (IVS), and penetration testing. You'll also help design and report on our detection and remediation activities. This is a full-time position. Occasional after-hours work may be required for incident response or urgent security tasks. Successful candidates will be enrolled on a fully funded training pathway and will be provided with mentoring support to help them grow and learn.
Responsibilities:
1. Configuring and tuning our tools
- Help configure, tune, and maintain our vulnerability tooling across scanning tools, working with platform and engineering teams to keep coverage accurate
- Support day-to-day scanning schedules and tooling integrations, including ticketing and CI/CD pipelines
- Look for opportunities to automate reporting, validation, and other repetitive tasks across the whole vulnerability lifecycle
2. Triage and risk assessment
- Triage findings from vulnerability sources, confirming genuine issues and filtering out false positives
- Risk-assess confirmed findings against severity, exploitability, and business context, to prioritise fixes
- Apply a consistent risk-scoring approach so findings are prioritised effectively, regardless of source
- Stay on top of current threats and trends (e.g. threat actors, new vulnerabilities etc.) to inform vulnerability management activities
3. Designing secure benchmarks and guidelines
- Develop and maintain secure configuration benchmarks and hardening guidelines for our software, infrastructure, and tooling
- Align benchmarks and guidelines to recognised industry frameworks for business
- Work with the right teams to help implement the secure configurations, providing practical advice, and facilitating deviations within our broader risk management framework
4. Working with Developers and Engineers
- Act as a primary contact point for Developers and Engineers to help them understand and fix issues
- Track remediation progress, chase owners on overdue items, escalate where necessary
- Support teams with practical remediation guidance, drawing on the OWASP Top 10, the Mitre Att&ck Framework, and our secure coding standards
5. Coordinating IVS, web application testing, and penetration testing
- Organise our externally delivered IVS and Penetration Testing programmes, from scheduling and scoping, through to day-to-day contact with our testing partners
- Help manage our relationships with testing providers, including engagement administration and reporting
6. SLAs, outcome driven metrics, and reporting
- Help design and report on remediation SLAs across vulnerability classes, severities, and products
- Produce regular reporting (monthly, quarterly, and ad-hoc) on SLA performance, open findings, and trends
- Feed data and insight into our wider security metrics and reporting processes
7. Continuous improvement and team support
- Suggest ways to improve how we manage vulnerabilities and the tools we use to do it
- Support the rollout of new scanning tools or process changes across our global product estate
- Help create and maintain our vulnerability management policies, standards, and procedures
Requirements:
- 2+ years' experience in vulnerability management, security operations, development, or a related security/IT role
- Hands-on experience with vulnerability scanning and management tooling (e.g. SAST, DAST, SCA, CSPM, or IVS)
- Solid understanding of common vulnerability types and remediation approaches, including familiarity with the Mitre ATT&CK Framework and OWASP Top 10
- Experience triaging and risk-assessing security findings, helping teams to prioritise remediation based on severity and business impact
- Comfortable coordinating third-party engagements, such as scheduling and scoping penetration tests
- Comfortable explaining technical findings to both Developers and non-technical stakeholders
- Organised enough to manage several scanning programmes, testing engagements, and remediation workstreams in parallel
- Comfortable working across a global, multi-product environment
- Comfortable working within an agile enterprise environment
- Ability to read and understand common coding languages is essential, the ability to write scripts and/or code is preferred
- Relevant certifications (e.g. CompTIA Security+, CompTIA CySA+, GIAC GFACT/GPEN, or CEH) are preferred but not essential
- Strong analytical and problem-solving mindset, with real attention to detail
- Ability to work autonomously, use good judgement, and know when to escalate
Benefits
Perks at ITG — alongside a competitive salary, here's what you can look forward to:
- Time off that works for you — 25 days' holiday + bank holidays, a paid Wellbeing Day, flexible bank holidays to honour cultural or religious observances, and the option to buy or carry over up to 5 extra days.
- Family & life milestones — Enhanced family friendly leave, 3 extra days for your wedding/honeymoon, and an Employee Assistance Programme whenever you need support.
- Financial perks — Pension scheme, Corporate Medical Cash Plan, electric car salary sacrifice scheme, and tax-efficient payroll giving to your favourite charities.
- Growth & recognition — Funding for professional qualifications, monthly Employee of the Month awards (£250 bonus), and referral bonuses of up to £1,500.
- Community & wellbeing — Regular Wellbeing Workshops, 30+ Wellbeing Champions, a paid Volunteer Day, and an online perks platform with discounts on top brands, days out, and gym memberships.
What next? Like what you see? Drop us your application and someone from our team will be in touch.
We Value Diversity
We champion and welcome diversity in our workforce and ensure all job applicants receive equal and fair treatment, regardless of age, race, gender or gender identity, religion, sexual orientation, disability, or nationality.
We are not only committed to increasing the visibility and recognition of talent from under-represented groups within our organisation, but the wider industry too.
At the end of the day, we make sure we take time to look after ourselves, each other, and the planet, because we’re always stronger together.
ITG have a number of community groups available to employees and exist to offer a safe space for like-minded colleagues, with shared interests to connect, socialise and check in with each other.
What next?
If you found yourself interested in knowing more, drop us your application and someone from our team will be in touch.
#LI-NW1
Hello! We are Inspired Thinking Group (ITG).Big brands like Costa, KFC, PUMA, John Lewis & Partners, M&S, Jaguar Land Rover (JLR), and many more trust ITG to deliver the halo of engaging, tech-powered, agile content that helps them connect with their customers. Bringing this to life are our amazing ITGers (1400+), and we know they’re at their best when we get their working environment right. That means prioritising their Wellbeing through our dedicated, award-winning programme and team of 50+ Wellbeing Champions. It means platforming diversity and inclusion at every opportunity, including our Together Groups which help establish connections within our diverse communities. It means taking sustainability seriously by planting trees in areas hit by climate change, joining the UN Global Compact, and being named the Best Sustainable Technology-Led Marketing Agency in Europe. Most of all, it means building on the culture of fun and togetherness that sets us apart in our industry. Sound good? Check out our vacancies and apply today!
Hello! We are Inspired Thinking Group (ITG).
Big brands like Costa, KFC, PUMA, John Lewis & Partners, M&S, Jaguar Land Rover (JLR), and many more trust ITG to deliver the halo of engaging, tech-powered, agile content that helps them connect with their customers. Bringing this to life are our amazing ITGers (1400+), and we know they’re at their best when we get their working environment right.
That means prioritising their Wellbeing through our dedicated, award-winning programme and team of 50+ Wellbeing Champions. It means platforming diversity and inclusion at every opportunity, including our Together Groups which help establish connections within our diverse communities. It means taking sustainability seriously by planting trees in areas hit by climate change, joining the UN Global Compact, and being named the Best Sustainable Technology-Led Marketing Agency in Europe.
Most of all, it means building on the culture of fun and togetherness that sets us apart in our industry.
Sound good? Check out our vacancies and apply today!
